file[.]exe | Triage™

General

Target
file.exe
Size 1.1MB
Sample231125-tx3pwsbe54
SHA256 f641a3e31afa3b0502d4490f22bb56b480f8a50a45dd38e41d53370d325943a9
MD5 3bbdfbcc0bf3dddbd6e8706113d81a36
SHA1 119bf65626c051a451af1d1d1bc4e1b3986ab052
SHA512 912e18af291fe3150c94d3a3701de30335755ca61afdc6969370b2c13f3ecdbe66f54cfdd21dc7aa91e9a0199ece370e266a8472088c4a03286491d565f0e263
SSDEEP 12288:cQYUdZzN0OFYvMeTVRq6TFXJdzIEKJGnaQXiugklpJPK4lopDlQFeJ:3dZh0OFYvMeTVRfXcdJG5hevM8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 1.1MB

file.exe

IMPHASH 9ee1669563594b7c955925e47aab0ef0
SHA256 f641a3e31afa3b0502d4490f22bb56b480f8a50a45dd38e41d53370d325943a9
MD5 3bbdfbcc0bf3dddbd6e8706113d81a36
SHA1 119bf65626c051a451af1d1d1bc4e1b3986ab052
SHA512 912e18af291fe3150c94d3a3701de30335755ca61afdc6969370b2c13f3ecdbe66f54cfdd21dc7aa91e9a0199ece370e266a8472088c4a03286491d565f0e263
SSDEEP 12288:cQYUdZzN0OFYvMeTVRq6TFXJdzIEKJGnaQXiugklpJPK4lopDlQFeJ:3dZh0OFYvMeTVRfXcdJG5hevM8
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

CancelDC

kernel32

CreateThread WaitForSingleObject CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo FormatMessageA GetStringTypeW WideCharToMultiByte MultiByteToWideChar QueryPerformanceFrequency EncodePointer DecodePointer InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW LocalFree GetLocaleInfoEx InitializeCriticalSectionEx LCMapStringEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetFileInformationByHandleEx CreateSymbolicLinkW CompareStringEx GetCPInfo CreateFileW RaiseException RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW ExitThread ResumeThread FreeLibraryAndExitThread GetCurrentThread HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap GetFileType SetConsoleCtrlHandler OutputDebugStringW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc GetTimeZoneInformation HeapSize WriteConsoleW

Name

.text

Size

753KB

Virtual Size

753KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

273KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

gdi32

kernel32

generic